github.com
https://github.com/ImageMagick/ImageMagick CVE-2026-28692
MEDIUM
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
Record summary
CVE-2026-28692 has a selected CVSS score of 4.8 (medium).
Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 20| Product | Source | Version range | Status |
|---|---|---|---|
ImageMagickBrowse ImageMagick / ImageMagick | CVE List | >= 7.0.0, < 7.1.2-16 | affected |
| < 6.9.13-41 | affected | ||
Magick.NET-Q16-AnyCPUBrowse NuGet / Magick.NET-Q16-AnyCPU | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-AnyCPUBrowse NuGet / Magick.NET-Q16-HDRI-AnyCPU | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-OpenMP-arm64Browse NuGet / Magick.NET-Q16-HDRI-OpenMP-arm64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-OpenMP-x64Browse NuGet / Magick.NET-Q16-HDRI-OpenMP-x64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-arm64Browse NuGet / Magick.NET-Q16-HDRI-arm64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-x64Browse NuGet / Magick.NET-Q16-HDRI-x64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-HDRI-x86Browse NuGet / Magick.NET-Q16-HDRI-x86 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-OpenMP-arm64Browse NuGet / Magick.NET-Q16-OpenMP-arm64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-OpenMP-x64Browse NuGet / Magick.NET-Q16-OpenMP-x64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-OpenMP-x86Browse NuGet / Magick.NET-Q16-OpenMP-x86 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
Magick.NET-Q16-arm64Browse NuGet / Magick.NET-Q16-arm64 | GitHub Advisory | Before 14.10.4 · Fixed in 14.10.4 | affected |
References
4github.comConfirmation
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mrmj-x24c-wwcv github.com
https://github.com/dlemstra/Magick.NET/releases/tag/14.10.4 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-28692